IT Services
Portfolio

Consolieri

Overview

Consolieri is a remote connection and local console manager for engineers working with SSH, command-line shells, RDP, and VNC. The main desktop application is open source and works without an account, while the cloud portal adds profile synchronization and recovery across devices.

The project combines a desktop client, a web portal, and a cloud API. Sensitive data is never transferred to the cloud in plaintext: backups are encrypted on the user's device, and the server stores only encrypted content.

Product Features

The system includes:

  • SSH, local shell, RDP, and VNC access in one desktop application
  • Multiple tabs and windows for working with several connections in parallel
  • Offline use without mandatory registration
  • End-to-end encryption for profile backups
  • Profile recovery on another device using a synchronization key
  • Connected-device management through the web portal
  • Subscription and cloud-feature management

Cloud synchronization is separate from the application's core functionality. Users can work locally, while a subscription is required only to back up and restore profiles through the cloud.

Architecture

The Consolieri cloud platform consists of several services:

  • A Next.js web portal
  • A Go REST API
  • PostgreSQL for accounts, devices, subscriptions, and backup metadata
  • S3-compatible MinIO storage for encrypted files
  • Keycloak for authentication
  • A separate payment service supporting Paddle, Stripe, and other payment gateways
  • Mailoo as the headless CMS for the blog and forms

The web portal uses browser sessions, while the desktop client follows a separate OAuth flow with PKCE and receives short-lived API tokens. This separation keeps browser authentication distinct from the access model of a public desktop client.

Infrastructure & SRE

The project has:

  • GitLab CI for checks, tests, and builds
  • Container builds with Kaniko
  • Separate images for the web application, API, payment service, migrator, and Keycloak theme
  • GitOps deployment through ArgoCD
  • Migrations run as a separate task before the API is updated
  • Health and readiness checks for the web application and API
  • Secret management for Keycloak, Paddle, Mailoo, MinIO, and internal services
  • Automated cleanup of old images and controls on registry cache growth

The API does not run migrations on startup. A dedicated image is built for them and launched as an ArgoCD PreSync job before the new application version is deployed. This separates database schema changes from the lifecycle of the main service.

Engineering Challenges

The project's key engineering challenges extend beyond the connection manager interface to the trust boundaries between the desktop application and the cloud:

  • Separating browser and desktop authentication
  • OAuth for a public desktop client without an embedded secret
  • Encrypting backups before they are sent to the server
  • Client-side backup encryption: the server stores only encrypted data and never receives the decryption key
  • Refresh-token rotation and reuse detection
  • Coordinating database schema and API updates
  • Controlling build-cache size and container-registry disk usage

The resulting cloud features complement the desktop application without turning the server into a repository of plaintext connection secrets.